这篇论文提出了 ANTAP，用代数投影代替代理描述做路由，把注入攻击成功率打到了接近零，比传统方法安全太多。
ANTAP 是一种评估驱动的路由架构，通过主动能力测试取代代理的文本描述或嵌入代理。在实验中，ANTAP 对基于描述的注入攻击的攻击成功率（ASR）接近 0%，而基于描述的路由基线 ASR 达到 67.3% 以上。对于自适应嵌入攻击，ANTAP 的 ASR 比基于嵌入的基线降低 20%，且设计上对描述操控具有鲁棒性。该架构建立“语言防火墙”，使基于元数据的攻击无法表达。
Linguistic Firewall: Geometry as Defense in Multi-Agent Systems Routing
The rapid integration of Large Language Models (LLMs) has driven the evolution of Multi-Agent Systems (MAS), where specialized agents collaborate to execute complex workflows. Effective orchestration in these environments requires robust routing mechanisms to efficiently allocate tasks to the most suitable agent. However, existing routers fundamentally rely on unverified proxies, ranging from textual self-descriptions to static surrogate representations, to gauge an agent's competence. This reliance on non-empirical data creates a critical gap between an agent's projected profile and its actual operational capabilities, introducing severe security vulnerabilities. Malicious agents can easily misrepresent their proficiencies or harbor covert backdoors that evade both standard external analysis and static representation-learning techniques. In this work, we introduce ANTAP (Automatic Non-Textual Agent Picker), an evaluation-driven routing architecture that discards indirect proxies in favor of active capability testing. By dynamically querying agents to ascertain their true competencies empirically, ANTAP distills performance into fixed behavioral operators within a shared semantic space. At inference time, routing is performed via a purely non-textual algebraic projection, establishing a "linguistic firewall" that renders metadata-based attacks inexpressible. In our experiments, ANTAP achieves near-zero ASR against description-based injection attacks, compared to 67.3\% and above for the description-based router baseline. Against adaptive embedding attacks, ANTAP achieves substantially lower ASR than the embedding-based baseline, with a 20\% reduction, while remaining resilient to description manipulation by design.